All publishers require that the eBooks they submit, including free eBooks, are encrypted for each customer. The "unlock" device is the billing name and credit card number of the primary credit card on your Barnes & Noble account. Currently, credit cards are the only payment method that can be applied to orders for eBooks.
However, our customers have told us that they would like us to provide a gift card option for eBook purchases.
We hope to have this gift card available shortly, please visit our website often for updates.
It looks like they weren't kidding. Just now, another reader emailed us to point out this update on the B&N "Unbound" blog:
We'll soon accept Barnes & Noble gift cards as payment in our eBook store.
This change - effective in mid-December - will allow customers to use physical gift cards and online gift certificates to purchase eBooks through our site, through nook, and through other devices using the B&N eReader software.
We'll have full details (including the specific launch date) in mid-December.
In the meantime, we want to say thanks for your suggestions and enthusiasm. We were able to accelerate this change due in part to the customer feedback.
"Coming Soon: Gift Card Purchases for eBooks" [Unbound: The eReading Blog] (Thanks to Kerry!)
RELATED
"You Can't Use A Barnes & Noble Gift Card For Ebooks"
The first thing I thought of is what if I no longer use a card anymore and have closed the account? Or if my card number changes? Or if I just use a new card as the primary that has better rewards?
Do you have to use a different number for each purchase if you had a different primary? Sounds like it's encrypted in the file, so you'd have to. What if you like to use a credit card, but not leave that info stored on their servers?
That so totally sucks.
]]>Maybe I'm just being a pessimist, but without a firm guaranteed date from Barnes & Noble, this just seems like an attempt to not lose out on lucrative gift card sales right before the holiday season. I can easily see B&N pushing the date back to January and then coming back in the new year saying they can't figure out a workaround to the problem and they won't be offering refunds on the cards.
]]>With how often my bank loses my credit card info, Credit Card #'s don't seem all that secure to me. I wonder if you have to redownload all your ebooks each time your bank issues a new number. That would be a hassle.
]]>Second, there's no way in hell B&N is using raw credit card info as keys, precisely because it would be stupidly insecure. If I had to guess, they're using some sort of internal key combined with a hash of the billing information to create the final key.
]]>Does this mean that when I change card numbers (or even banks) that it will have (1) assorted books unlocked with different CC numbers, (2) older purchases no longer unlockable because the primary CC number no longer matches, or (3) that all the unlocking codes will change on all files?
What about name changes (marriage, etc.)? Will that change the accessibility?
Will one have to remember which credit card was active, and what name was on it for books one bought in order to restore them?
I see potential interesting problems depending on exactly how the information is stored and reteieved.
Tomas
]]>I find this interesting from a security standpoint. Using the Credit card info as a DRM method seems like a bad idea.
I havent looked much into it, but how hard would it be to crack a kindle users account, redownload one of the files they bought, then attack the file to get the CC number.
Here is what I come up with off the top of my head.
1. Find a few kindle users account
2. Crack the account on Amazons site
3. Retireve saved account info (usually the last 4 digits of the CC as well as billing address)
4. Download a file and attack it using a known key pattern (if they are using it as a key, the patter is going to be the same)
5. brute force the CC number. You already have 4 of the 16 digits, you know its a set length and you know its only digital.
So that 10 trillion possible combinations, assuming you dont know anyof the other numbers. You could then use say the 10 most common banks that distribute cards, and you then have the first 8 digits of the card, which leave just a few hundred thousand compbinations, which can be cracked in minutes.
Once you have the software written with the correct parameters set, its just a matter of collecting the account info from amazon, which I doubt is very hard becasue most people dont consider their kindle accounts to be sensetive like a bank account, and use weak passwords.
I bet you could get a fair number of credit card numbers and their billing info pretty quick.
I have to imagine there is stuff in place to prevent this, but DRM as a whole gets cracked quickly becasue to be amble to distrbute and manage it, it needs to be predictable (there has to be a set alogrythm in the software to hash the data and create the key for the lock) This is why Key genorators and the like get produced so quickly and continue working, and why a CC number being used as that key is a terrible idea.
]]>Yay!! I get countless B&N gift cards each year for Christmas because I have unimaginative relatives (not that I'm complaining, it's way better than bath products). I may have some left over this year after I pool them to buy a Nook, so this is very nice.
I already use eReader on my Blackberry and it doesn't seem like it'd be difficult to rearrange the unlocking mechanism. Maybe buy the books with gift cards, but you still have to put in a credit card number (never charged) to unlock them?
]]>